cscli parsers install PintjesB/technitium-logsParsing of Technitium DNS server logs
Example acquisition for this collection:
1---2filenames:3 - /syslog-server/technitium.log4labels:5 type: technitium
1name: PintjesB/technitium-logs2description: "Parse Technitium auth logs"3onsuccess: next_stage4filter: evt.Parsed.program == 'technitium'5pattern_syntax:6 TECHNITIUM_DATETIME: '%{YEAR:year}-%{MONTHNUM:month}-%{MONTHDAY:day} %{TIME:time} %{TZ}'7nodes:8 - grok:9 pattern: '^\[%{TECHNITIUM_DATETIME}\] \[%{IP:source_ip}:%{INT:source_port}\] DnsServerCore.DnsWebServiceException: Invalid username or password for user: %{USERNAME:username}'10 apply_on: message11 statics:12 - meta: log_type13 value: technitium_failed_auth1415statics:16 - meta: service17 value: technitium18 - target: evt.StrTime19 expression: "evt.Parsed.year + '/' + evt.Parsed.month + '/' + evt.Parsed.day + ' ' + evt.Parsed.time"20 - meta: source_ip21 expression: "evt.Parsed.source_ip"22 - meta: source_port23 expression: "evt.Parsed.source_port"24 - meta: username25 expression: "evt.Parsed.username"